Georgi Boiko

**Name of the Vulnerable Software and Affected Versions** OnePlus 7 Pro versions prior to 10.0.3.GM21BA **Description** An issue was found in the firmware of the affected devices, where a privileged user, such as a root user in the Rich Execution Environment (REE), can obtain bitmap images from the fingerprint sensor due to leftover debug code. The Trusted Application (TA) supports more commands than necessary for fingerprint authentication, allowing an attacker with the ability to send commands to the TA to retrieve a raw fingerprint image. This means the Trusted Execution Environment (TEE) no longer protects identifiable fingerprint data from the REE. **Recommendations** For versions prior to 10.0.3.GM21BA, update to version 10.0.3.GM21BA or later to resolve the issue. As a temporary workaround, consider restricting access to the fingerprint sensor functionality to minimize the risk of exploitation.